2088279 - Remove Email trust bit from IdenTrust Commercial Root CA 1

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Ben Wilson]

Please remove the Email (S/MIME) trust bit from the following root certificate in NSS:

• Certificate name: IdenTrust Commercial Root CA 1
• SHA-256 fingerprint: 5D56499BE4D2E08BCFCAD08A3E38723D50503BDE706948E42F55603019E528AE
• Current trust: Websites, Email
• Requested trust: Websites and EV

This change implements the transition to TLS-only trust described in Bug 2031867. IdenTrust’s transition plan calls for removal of the Email trust bit following June 2026 migration and revocation of the non-TLS subordinate CA certificates under this root.

Please update the root’s trust record in certdata.txt to disable Email trust while retaining Websites trust.

Comment 1

[Anna Weine]

Attachment: Bug 2088279 - Remove Email Trust Bit from IdenTrust Commercial Root CA 1. r=bwilson

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/projects/nss/rev/76de250af25d
Remove Email Trust Bit from IdenTrust Commercial Root CA 1. r=bwilson